Testing the Proof System: Negative Controls and Dependency Evidence in Ota

A green call does not prove the dependency mattered A service can be reachable without being exercised. An application can call a dependency without proving the dependency shaped the tested obligation...